1. 07 11月, 2018 1 次提交
    • J
      platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey · 78f3ac76
      João Paulo Rechi Vita 提交于
      In the past, Asus firmwares would change the panel backlight directly
      through the EC when the display off hotkey (Fn+F7) was pressed, and
      only notify the OS of such change, with 0x33 when the LCD was ON and
      0x34 when the LCD was OFF. These are currently mapped to
      KEY_DISPLAYTOGGLE and KEY_DISPLAY_OFF, respectively.
      
      Most recently the EC on Asus most machines lost ability to toggle the
      LCD backlight directly, but unless the OS informs the firmware it is
      going to handle the display toggle hotkey events, the firmware still
      tries change the brightness through the EC, to no effect. The end result
      is a long list (at Endless we counted 11) of Asus laptop models where
      the display toggle hotkey does not perform any action. Our firmware
      engineers contacts at Asus were surprised that there were still machines
      out there with the old behavior.
      
      Calling WMNB(ASUS_WMI_DEVID_BACKLIGHT==0x00050011, 2) on the _WDG device
      tells the firmware that it should let the OS handle the display toggle
      event, in which case it will simply notify the OS of a key press with
      0x35, as shown by the DSDT excerpts bellow.
      
       Scope (_SB)
       {
           (...)
      
           Device (ATKD)
           {
               (...)
      
               Name (_WDG, Buffer (0x28)
               {
                   /* 0000 */  0xD0, 0x5E, 0x84, 0x97, 0x6D, 0x4E, 0xDE, 0x11,
                   /* 0008 */  0x8A, 0x39, 0x08, 0x00, 0x20, 0x0C, 0x9A, 0x66,
                   /* 0010 */  0x4E, 0x42, 0x01, 0x02, 0x35, 0xBB, 0x3C, 0x0B,
                   /* 0018 */  0xC2, 0xE3, 0xED, 0x45, 0x91, 0xC2, 0x4C, 0x5A,
                   /* 0020 */  0x6D, 0x19, 0x5D, 0x1C, 0xFF, 0x00, 0x01, 0x08
               })
               Method (WMNB, 3, Serialized)
               {
                   CreateDWordField (Arg2, Zero, IIA0)
                   CreateDWordField (Arg2, 0x04, IIA1)
                   Local0 = (Arg1 & 0xFFFFFFFF)
      
                   (...)
      
                   If ((Local0 == 0x53564544))
                   {
                       (...)
      
                       If ((IIA0 == 0x00050011))
                       {
                           If ((IIA1 == 0x02))
                           {
                               ^^PCI0.SBRG.EC0.SPIN (0x72, One)
                               ^^PCI0.SBRG.EC0.BLCT = One
                           }
      
                           Return (One)
                       }
                   }
                   (...)
               }
               (...)
           }
           (...)
       }
       (...)
      
       Scope (_SB.PCI0.SBRG.EC0)
       {
           (...)
      
           Name (BLCT, Zero)
      
           (...)
      
           Method (_Q10, 0, NotSerialized)  // _Qxx: EC Query
           {
               If ((BLCT == Zero))
               {
                   Local0 = One
                   Local0 = RPIN (0x72)
                   Local0 ^= One
                   SPIN (0x72, Local0)
                   If (ATKP)
                   {
                       Local0 = (0x34 - Local0)
                       ^^^^ATKD.IANE (Local0)
                   }
               }
               ElseIf ((BLCT == One))
               {
                   If (ATKP)
                   {
                       ^^^^ATKD.IANE (0x35)
                   }
               }
           }
           (...)
       }
      Signed-off-by: NJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      78f3ac76
  2. 31 10月, 2018 2 次提交
  3. 19 10月, 2018 1 次提交
  4. 19 9月, 2018 3 次提交
    • L
      PCI: hotplug: Embed hotplug_slot · 125450f8
      Lukas Wunner 提交于
      When the PCI hotplug core and its first user, cpqphp, were introduced in
      February 2002 with historic commit a8a2069f432c, cpqphp allocated a slot
      struct for its internal use plus a hotplug_slot struct to be registered
      with the hotplug core and linked the two with pointers:
      https://git.kernel.org/tglx/history/c/a8a2069f432c
      
      Nowadays, the predominant pattern in the tree is to embed ("subclass")
      such structures in one another and cast to the containing struct with
      container_of().  But it wasn't until July 2002 that container_of() was
      introduced with historic commit ec4f214232cf:
      https://git.kernel.org/tglx/history/c/ec4f214232cf
      
      pnv_php, introduced in 2016, did the right thing and embedded struct
      hotplug_slot in its internal struct pnv_php_slot, but all other drivers
      cargo-culted cpqphp's design and linked separate structs with pointers.
      
      Embedding structs is preferrable to linking them with pointers because
      it requires fewer allocations, thereby reducing overhead and simplifying
      error paths.  Casting an embedded struct to the containing struct
      becomes a cheap subtraction rather than a dereference.  And having fewer
      pointers reduces the risk of them pointing nowhere either accidentally
      or due to an attack.
      
      Convert all drivers to embed struct hotplug_slot in their internal slot
      struct.  The "private" pointer in struct hotplug_slot thereby becomes
      unused, so drop it.
      Signed-off-by: NLukas Wunner <lukas@wunner.de>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Acked-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>  # drivers/pci/hotplug/rpa*
      Acked-by: Sebastian Ott <sebott@linux.ibm.com>        # drivers/pci/hotplug/s390*
      Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com> # drivers/platform/x86
      Cc: Len Brown <lenb@kernel.org>
      Cc: Scott Murray <scott@spiteful.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Oliver OHalloran <oliveroh@au1.ibm.com>
      Cc: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
      Cc: Corentin Chary <corentin.chary@gmail.com>
      Cc: Darren Hart <dvhart@infradead.org>
      125450f8
    • L
      PCI: hotplug: Drop hotplug_slot_info · a7da2161
      Lukas Wunner 提交于
      Ever since the PCI hotplug core was introduced in 2002, drivers had to
      allocate and register a struct hotplug_slot_info for every slot:
      https://git.kernel.org/tglx/history/c/a8a2069f432c
      
      Apparently the idea was that drivers furnish the hotplug core with an
      up-to-date card presence status, power status, latch status and
      attention indicator status as well as notify the hotplug core of changes
      thereof.  However only 4 out of 12 hotplug drivers bother to notify the
      hotplug core with pci_hp_change_slot_info() and the hotplug core never
      made any use of the information:  There is just a single macro in
      pci_hotplug_core.c, GET_STATUS(), which uses the hotplug_slot_info if
      the driver lacks the corresponding callback in hotplug_slot_ops.  The
      macro is called when the user reads the attribute via sysfs.
      
      Now, if the callback isn't defined, the attribute isn't exposed in sysfs
      in the first place (see e.g. has_power_file()).  There are only two
      situations when the hotplug_slot_info would actually be accessed:
      
      * If the driver defines ->enable_slot or ->disable_slot but not
        ->get_power_status.
      
      * If the driver defines ->set_attention_status but not
        ->get_attention_status.
      
      There is no driver doing the former and just a single driver doing the
      latter, namely pnv_php.c.  Amend it with a ->get_attention_status
      callback.  With that, the hotplug_slot_info becomes completely unused by
      the PCI hotplug core.  But a few drivers use it internally as a cache:
      
      cpcihp uses it to cache the latch_status and adapter_status.
      cpqhp uses it to cache the adapter_status.
      pnv_php and rpaphp use it to cache the attention_status.
      shpchp uses it to cache all four values.
      
      Amend these drivers to cache the information in their private slot
      struct.  shpchp's slot struct already contains members to cache the
      power_status and adapter_status, so additional members are only needed
      for the other two values.  In the case of cpqphp, the cached value is
      only accessed in a single place, so instead of caching it, read the
      current value from the hardware.
      
      Caution:  acpiphp, cpci, cpqhp, shpchp, asus-wmi and eeepc-laptop
      populate the hotplug_slot_info with initial values on probe.  That code
      is herewith removed.  There is a theoretical chance that the code has
      side effects without which the driver fails to function, e.g. if the
      ACPI method to read the adapter status needs to be executed at least
      once on probe.  That seems unlikely to me, still maintainers should
      review the changes carefully for this possibility.
      
      Rafael adds: "I'm not aware of any case in which it will break anything,
      [...] but if that happens, it may be necessary to add the execution of
      the control methods in question directly to the initialization part."
      Signed-off-by: NLukas Wunner <lukas@wunner.de>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Acked-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>  # drivers/pci/hotplug/rpa*
      Acked-by: Sebastian Ott <sebott@linux.ibm.com>        # drivers/pci/hotplug/s390*
      Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com> # drivers/platform/x86
      Cc: Len Brown <lenb@kernel.org>
      Cc: Scott Murray <scott@spiteful.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Oliver OHalloran <oliveroh@au1.ibm.com>
      Cc: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
      Cc: Corentin Chary <corentin.chary@gmail.com>
      Cc: Darren Hart <dvhart@infradead.org>
      a7da2161
    • L
      PCI: hotplug: Constify hotplug_slot_ops · 81c4b5bf
      Lukas Wunner 提交于
      Hotplug drivers cannot declare their hotplug_slot_ops const, making them
      attractive targets for attackers, because upon registration of a hotplug
      slot, __pci_hp_initialize() writes to the "owner" and "mod_name" members
      in that struct.
      
      Fix by moving these members to struct hotplug_slot and constify every
      driver's hotplug_slot_ops except for pciehp.
      
      pciehp constructs its hotplug_slot_ops at runtime based on the PCIe
      port's capabilities, hence cannot declare them const.  It can be
      converted to __write_rarely once that's mainlined:
      http://www.openwall.com/lists/kernel-hardening/2016/11/16/3Signed-off-by: NLukas Wunner <lukas@wunner.de>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Reviewed-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      Acked-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>  # drivers/pci/hotplug/rpa*
      Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com> # drivers/platform/x86
      Cc: Len Brown <lenb@kernel.org>
      Cc: Scott Murray <scott@spiteful.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Oliver OHalloran <oliveroh@au1.ibm.com>
      Cc: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
      Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
      Cc: Corentin Chary <corentin.chary@gmail.com>
      Cc: Darren Hart <dvhart@infradead.org>
      81c4b5bf
  5. 24 7月, 2018 1 次提交
    • L
      PCI: hotplug: Demidlayer registration with the core · 51bbf9be
      Lukas Wunner 提交于
      When a hotplug driver calls pci_hp_register(), all steps necessary for
      registration are carried out in one go, including creation of a kobject
      and addition to sysfs.  That's a problem for pciehp once it's converted
      to enable/disable the slot exclusively from the IRQ thread:  The thread
      needs to be spawned after creation of the kobject (because it uses the
      kobject's name), but before addition to sysfs (because it will handle
      enable/disable requests submitted via sysfs).
      
      pci_hp_deregister() does offer a ->release callback that's invoked
      after deletion from sysfs and before destruction of the kobject.  But
      because pci_hp_register() doesn't offer a counterpart, hotplug drivers'
      ->probe and ->remove code becomes asymmetric, which is error prone
      as recently discovered use-after-free bugs in pciehp's ->remove hook
      have shown.
      
      In a sense, this appears to be a case of the midlayer antipattern:
      
         "The core thesis of the "midlayer mistake" is that midlayers are
          bad and should not exist.  That common functionality which it is
          so tempting to put in a midlayer should instead be provided as
          library routines which can [be] used, augmented, or ignored by
          each bottom level driver independently.  Thus every subsystem
          that supports multiple implementations (or drivers) should
          provide a very thin top layer which calls directly into the
          bottom layer drivers, and a rich library of support code that
          eases the implementation of those drivers.  This library is
          available to, but not forced upon, those drivers."
              --  Neil Brown (2009), https://lwn.net/Articles/336262/
      
      The presence of midlayer traits in the PCI hotplug core might be ascribed
      to its age:  When it was introduced in February 2002, the blessings of a
      library approach might not have been well known:
      https://git.kernel.org/tglx/history/c/a8a2069f432c
      
      For comparison, the driver core does offer split functions for creating
      a kobject (device_initialize()) and addition to sysfs (device_add()) as
      an alternative to carrying out everything at once (device_register()).
      This was introduced in October 2002:
      https://git.kernel.org/tglx/history/c/8b290eb19962
      
      The odd ->release callback in the PCI hotplug core was added in 2003:
      https://git.kernel.org/tglx/history/c/69f8d663b595
      
      Clearly, a library approach would not force every hotplug driver to
      implement a ->release callback, but rather allow the driver to remove
      the sysfs files, release its data structures and finally destroy the
      kobject.  Alternatively, a driver may choose to remove everything with
      pci_hp_deregister(), then release its data structures.
      
      To this end, offer drivers pci_hp_initialize() and pci_hp_add() as a
      split-up version of pci_hp_register().  Likewise, offer pci_hp_del()
      and pci_hp_destroy() as a split-up version of pci_hp_deregister().
      
      Eliminate the ->release callback and move its code into each driver's
      teardown routine.
      
      Declare pci_hp_deregister() void, in keeping with the usual kernel
      pattern that enablement can fail, but disablement cannot.  It only
      returned an error if the caller passed in a NULL pointer or a slot which
      has never or is no longer registered or is sharing its name with another
      slot.  Those would be bugs, so WARN about them.  Few hotplug drivers
      actually checked the return value and those that did only printed a
      useless error message to dmesg.  Remove that.
      
      For most drivers the conversion was straightforward since it doesn't
      matter whether the code in the ->release callback is executed before or
      after destruction of the kobject.  But in the case of ibmphp, it was
      unclear to me whether setting slot_cur->ctrl and slot_cur->bus_on to
      NULL needs to happen before the kobject is destroyed, so I erred on
      the side of caution and ensured that the order stays the same.  Another
      nontrivial case is pnv_php, I've found the list and kref logic difficult
      to understand, however my impression was that it is safe to delete the
      list element and drop the references until after the kobject is
      destroyed.
      Signed-off-by: NLukas Wunner <lukas@wunner.de>
      Signed-off-by: NBjorn Helgaas <bhelgaas@google.com>
      Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>  # drivers/platform/x86
      Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
      Cc: Len Brown <lenb@kernel.org>
      Cc: Scott Murray <scott@spiteful.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Gavin Shan <gwshan@linux.vnet.ibm.com>
      Cc: Sebastian Ott <sebott@linux.vnet.ibm.com>
      Cc: Gerald Schaefer <gerald.schaefer@de.ibm.com>
      Cc: Corentin Chary <corentin.chary@gmail.com>
      Cc: Darren Hart <dvhart@infradead.org>
      Cc: Andy Shevchenko <andy@infradead.org>
      51bbf9be
  6. 02 7月, 2018 2 次提交
  7. 31 5月, 2018 2 次提交
    • J
      platform/x86: asus-wmi: Fix NULL pointer dereference · cf48bf9e
      João Paulo Rechi Vita 提交于
      Do not perform the rfkill cleanup routine when
      (asus->driver->wlan_ctrl_by_user && ashs_present()) is true, since
      nothing is registered with the rfkill subsystem in that case. Doing so
      leads to the following kernel NULL pointer dereference:
      
        BUG: unable to handle kernel NULL pointer dereference at           (null)
        IP: [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        PGD 1a3aa8067
        PUD 1a3b3d067
        PMD 0
      
        Oops: 0002 [#1] PREEMPT SMP
        Modules linked in: bnep ccm binfmt_misc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core hid_a4tech videodev x86_pkg_temp_thermal intel_powerclamp coretemp ath3k btusb btrtl btintel bluetooth kvm_intel snd_hda_codec_hdmi kvm snd_hda_codec_realtek snd_hda_codec_generic irqbypass crc32c_intel arc4 i915 snd_hda_intel snd_hda_codec ath9k ath9k_common ath9k_hw ath i2c_algo_bit snd_hwdep mac80211 ghash_clmulni_intel snd_hda_core snd_pcm snd_timer cfg80211 ehci_pci xhci_pci drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm xhci_hcd ehci_hcd asus_nb_wmi(-) asus_wmi sparse_keymap r8169 rfkill mxm_wmi serio_raw snd mii mei_me lpc_ich i2c_i801 video soundcore mei i2c_smbus wmi i2c_core mfd_core
        CPU: 3 PID: 3275 Comm: modprobe Not tainted 4.9.34-gentoo #34
        Hardware name: ASUSTeK COMPUTER INC. K56CM/K56CM, BIOS K56CM.206 08/21/2012
        task: ffff8801a639ba00 task.stack: ffffc900014cc000
        RIP: 0010:[<ffffffff816c7348>]  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        RSP: 0018:ffffc900014cfce0  EFLAGS: 00010282
        RAX: 0000000000000000 RBX: ffff8801a54315b0 RCX: 00000000c0000100
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801a54315b4
        RBP: ffffc900014cfd30 R08: 0000000000000000 R09: 0000000000000002
        R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801a54315b4
        R13: ffff8801a639ba00 R14: 00000000ffffffff R15: ffff8801a54315b8
        FS:  00007faa254fb700(0000) GS:ffff8801aef80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000000000000 CR3: 00000001a3b1b000 CR4: 00000000001406e0
        Stack:
         ffff8801a54315b8 0000000000000000 ffffffff814733ae ffffc900014cfd28
         ffffffff8146a28c ffff8801a54315b0 0000000000000000 ffff8801a54315b0
         ffff8801a66f3820 0000000000000000 ffffc900014cfd48 ffffffff816c73e7
        Call Trace:
         [<ffffffff814733ae>] ? acpi_ut_release_mutex+0x5d/0x61
         [<ffffffff8146a28c>] ? acpi_ns_get_node+0x49/0x52
         [<ffffffff816c73e7>] mutex_lock+0x17/0x30
         [<ffffffffa00a3bb4>] asus_rfkill_hotplug+0x24/0x1a0 [asus_wmi]
         [<ffffffffa00a4421>] asus_wmi_rfkill_exit+0x61/0x150 [asus_wmi]
         [<ffffffffa00a49f1>] asus_wmi_remove+0x61/0xb0 [asus_wmi]
         [<ffffffff814a5128>] platform_drv_remove+0x28/0x40
         [<ffffffff814a2901>] __device_release_driver+0xa1/0x160
         [<ffffffff814a29e3>] device_release_driver+0x23/0x30
         [<ffffffff814a1ffd>] bus_remove_device+0xfd/0x170
         [<ffffffff8149e5a9>] device_del+0x139/0x270
         [<ffffffff814a5028>] platform_device_del+0x28/0x90
         [<ffffffff814a50a2>] platform_device_unregister+0x12/0x30
         [<ffffffffa00a4209>] asus_wmi_unregister_driver+0x19/0x30 [asus_wmi]
         [<ffffffffa00da0ea>] asus_nb_wmi_exit+0x10/0xf26 [asus_nb_wmi]
         [<ffffffff8110c692>] SyS_delete_module+0x192/0x270
         [<ffffffff810022b2>] ? exit_to_usermode_loop+0x92/0xa0
         [<ffffffff816ca560>] entry_SYSCALL_64_fastpath+0x13/0x94
        Code: e8 5e 30 00 00 8b 03 83 f8 01 0f 84 93 00 00 00 48 8b 43 10 4c 8d 7b 08 48 89 63 10 41 be ff ff ff ff 4c 89 3c 24 48 89 44 24 08 <48> 89 20 4c 89 6c 24 10 eb 1d 4c 89 e7 49 c7 45 08 02 00 00 00
        RIP  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
         RSP <ffffc900014cfce0>
        CR2: 0000000000000000
        ---[ end trace 8d484233fa7cb512 ]---
        note: modprobe[3275] exited with preempt_count 2
      
      https://bugzilla.kernel.org/show_bug.cgi?id=196467
      
      Reported-by: red.f0xyz@gmail.com
      Signed-off-by: NJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      cf48bf9e
    • J
      platform/x86: asus-wmi: Fix NULL pointer dereference · 32ffd6e8
      João Paulo Rechi Vita 提交于
      Do not perform the rfkill cleanup routine when
      (asus->driver->wlan_ctrl_by_user && ashs_present()) is true, since
      nothing is registered with the rfkill subsystem in that case. Doing so
      leads to the following kernel NULL pointer dereference:
      
        BUG: unable to handle kernel NULL pointer dereference at           (null)
        IP: [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        PGD 1a3aa8067
        PUD 1a3b3d067
        PMD 0
      
        Oops: 0002 [#1] PREEMPT SMP
        Modules linked in: bnep ccm binfmt_misc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core hid_a4tech videodev x86_pkg_temp_thermal intel_powerclamp coretemp ath3k btusb btrtl btintel bluetooth kvm_intel snd_hda_codec_hdmi kvm snd_hda_codec_realtek snd_hda_codec_generic irqbypass crc32c_intel arc4 i915 snd_hda_intel snd_hda_codec ath9k ath9k_common ath9k_hw ath i2c_algo_bit snd_hwdep mac80211 ghash_clmulni_intel snd_hda_core snd_pcm snd_timer cfg80211 ehci_pci xhci_pci drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm xhci_hcd ehci_hcd asus_nb_wmi(-) asus_wmi sparse_keymap r8169 rfkill mxm_wmi serio_raw snd mii mei_me lpc_ich i2c_i801 video soundcore mei i2c_smbus wmi i2c_core mfd_core
        CPU: 3 PID: 3275 Comm: modprobe Not tainted 4.9.34-gentoo #34
        Hardware name: ASUSTeK COMPUTER INC. K56CM/K56CM, BIOS K56CM.206 08/21/2012
        task: ffff8801a639ba00 task.stack: ffffc900014cc000
        RIP: 0010:[<ffffffff816c7348>]  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
        RSP: 0018:ffffc900014cfce0  EFLAGS: 00010282
        RAX: 0000000000000000 RBX: ffff8801a54315b0 RCX: 00000000c0000100
        RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801a54315b4
        RBP: ffffc900014cfd30 R08: 0000000000000000 R09: 0000000000000002
        R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801a54315b4
        R13: ffff8801a639ba00 R14: 00000000ffffffff R15: ffff8801a54315b8
        FS:  00007faa254fb700(0000) GS:ffff8801aef80000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000000000000 CR3: 00000001a3b1b000 CR4: 00000000001406e0
        Stack:
         ffff8801a54315b8 0000000000000000 ffffffff814733ae ffffc900014cfd28
         ffffffff8146a28c ffff8801a54315b0 0000000000000000 ffff8801a54315b0
         ffff8801a66f3820 0000000000000000 ffffc900014cfd48 ffffffff816c73e7
        Call Trace:
         [<ffffffff814733ae>] ? acpi_ut_release_mutex+0x5d/0x61
         [<ffffffff8146a28c>] ? acpi_ns_get_node+0x49/0x52
         [<ffffffff816c73e7>] mutex_lock+0x17/0x30
         [<ffffffffa00a3bb4>] asus_rfkill_hotplug+0x24/0x1a0 [asus_wmi]
         [<ffffffffa00a4421>] asus_wmi_rfkill_exit+0x61/0x150 [asus_wmi]
         [<ffffffffa00a49f1>] asus_wmi_remove+0x61/0xb0 [asus_wmi]
         [<ffffffff814a5128>] platform_drv_remove+0x28/0x40
         [<ffffffff814a2901>] __device_release_driver+0xa1/0x160
         [<ffffffff814a29e3>] device_release_driver+0x23/0x30
         [<ffffffff814a1ffd>] bus_remove_device+0xfd/0x170
         [<ffffffff8149e5a9>] device_del+0x139/0x270
         [<ffffffff814a5028>] platform_device_del+0x28/0x90
         [<ffffffff814a50a2>] platform_device_unregister+0x12/0x30
         [<ffffffffa00a4209>] asus_wmi_unregister_driver+0x19/0x30 [asus_wmi]
         [<ffffffffa00da0ea>] asus_nb_wmi_exit+0x10/0xf26 [asus_nb_wmi]
         [<ffffffff8110c692>] SyS_delete_module+0x192/0x270
         [<ffffffff810022b2>] ? exit_to_usermode_loop+0x92/0xa0
         [<ffffffff816ca560>] entry_SYSCALL_64_fastpath+0x13/0x94
        Code: e8 5e 30 00 00 8b 03 83 f8 01 0f 84 93 00 00 00 48 8b 43 10 4c 8d 7b 08 48 89 63 10 41 be ff ff ff ff 4c 89 3c 24 48 89 44 24 08 <48> 89 20 4c 89 6c 24 10 eb 1d 4c 89 e7 49 c7 45 08 02 00 00 00
        RIP  [<ffffffff816c7348>] __mutex_lock_slowpath+0x98/0x120
         RSP <ffffc900014cfce0>
        CR2: 0000000000000000
        ---[ end trace 8d484233fa7cb512 ]---
        note: modprobe[3275] exited with preempt_count 2
      
      https://bugzilla.kernel.org/show_bug.cgi?id=196467
      
      Reported-by: red.f0xyz@gmail.com
      Signed-off-by: NJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      32ffd6e8
  8. 23 4月, 2018 1 次提交
  9. 27 9月, 2017 1 次提交
  10. 13 8月, 2017 1 次提交
  11. 12 7月, 2017 1 次提交
  12. 29 4月, 2017 2 次提交
  13. 15 3月, 2017 1 次提交
  14. 13 3月, 2017 1 次提交
  15. 26 2月, 2017 1 次提交
    • J
      platform/x86: asus-wmi: Detect quirk_no_rfkill from the DSDT · 71050ae7
      João Paulo Rechi Vita 提交于
      Some Asus laptops that have an airplane-mode indicator LED, also have
      the WMI WLAN user bit set, and the following bits in their DSDT:
      
          Scope (_SB)
          {
            (...)
            Device (ATKD)
            {
              (...)
              Method (WMNB, 3, Serialized)
              {
                (...)
                If (LEqual (IIA0, 0x00010002))
                {
                  OWGD (IIA1)
                  Return (One)
                }
              }
            }
          }
      
      So when asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store the
      wlan state, it drives the airplane-mode indicator LED (through the call
      to OWGD) in an inverted fashion: the LED is ON when airplane mode is OFF
      (since wlan is ON), and vice-versa.
      
      This commit skips registering RFKill switches at all for these laptops,
      to allow the asus-wireless driver to drive the airplane mode LED
      correctly through the ASHS ACPI device. Relying on the presence of ASHS
      and ASUS_WMI_DSTS_USER_BIT avoids adding DMI-based quirks for at least
      21 different laptops.
      Signed-off-by: NJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      71050ae7
  16. 14 12月, 2016 1 次提交
    • K
      platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB · 8023eff1
      Kai-Chuan Hsieh 提交于
      The bluetooth adapter Atheros AR3012 can't be enumerated
      and make the bluetooth function broken.
      
      T:  Bus=02 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#=  5 Spd=12  MxCh= 0
      D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
      P:  Vendor=13d3 ProdID=3362 Rev=00.02
      S:  Manufacturer=Atheros Communications
      S:  Product=Bluetooth USB Host Controller
      S:  SerialNumber=Alaska Day 2006
      C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
      I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      
      The error is:
      
       usb 2-6: device not accepting address 7, error -62
       usb usb2-port6: unable to enumerate USB device
      
      It is caused by adapter's connected port is mapped to xHC
      controller, but the xHCI is not supported by the usb device.
      
      The output of 'sudo lspci -nnxxx -s 00:14.0':
      
       00:14.0 USB controller [0c03]: Intel Corporation 8 Series USB xHCI HC [8086:9c31] (rev 04)
       00: 86 80 31 9c 06 04 90 02 04 30 03 0c 00 00 00 00
       10: 04 00 a0 f7 00 00 00 00 00 00 00 00 00 00 00 00
       20: 00 00 00 00 00 00 00 00 00 00 00 00 43 10 1f 20
       30: 00 00 00 00 70 00 00 00 00 00 00 00 0b 01 00 00
       40: fd 01 36 80 89 c6 0f 80 00 00 00 00 00 00 00 00
       50: 5f 2e ce 0f 00 00 00 00 00 00 00 00 00 00 00 00
       60: 30 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       70: 01 80 c2 c1 08 00 00 00 00 00 00 00 00 00 00 00
       80: 05 00 87 00 0c a0 e0 fe 00 00 00 00 a1 41 00 00
       90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       a0: 00 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00
       b0: 0f 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00
       c0: 03 c0 30 00 00 00 00 00 03 0c 00 00 00 00 00 00
       d0: f9 01 00 00 f9 01 00 00 0f 00 00 00 0f 00 00 00
       e0: 00 08 00 00 00 00 00 00 00 00 00 00 d8 d8 00 00
       f0: 00 00 00 00 00 00 00 00 b1 0f 04 08 00 00 00 00
      
      By referencing Intel Platform Controller Hub(PCH) datasheet,
      the xHC USB 2.0 Port Routing(XUSB2PR) at offset 0xD0-0xD3h
      decides the setting of mapping the port to EHCI controller or
      xHC controller. And the port mapped to xHC will enable xHCI
      during bus resume.
      
      The setting of disabling bluetooth adapter's connected port is
      0x000001D9. The value can be obtained by few times 1 bit flip
      operation. The suited configuration should have the 'lsusb -t'
      result with bluetooth using ehci:
      
      /:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/4p, 5000M
      /:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/9p, 480M
          |__ Port 5: Dev 2, If 0, Class=Video, Driver=uvcvideo, 480M
          |__ Port 5: Dev 2, If 1, Class=Video, Driver=uvcvideo, 480M
      /:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/2p, 480M
          |__ Port 1: Dev 2, If 0, Class=Hub, Driver=hub/8p, 480M
              |__ Port 6: Dev 3, If 0, Class=Wireless, Driver=btusb, 12M
              |__ Port 6: Dev 3, If 1, Class=Wireless, Driver=btusb, 12M
      Signed-off-by: NKai-Chuan Hsieh <kai.chiuan@gmail.com>
      Acked-by: NCorentin Chary <corentin.chary@gmail.com>
      Reviewed-by: NAndy Shevchenko <andy.shevchenko@gmail.com>
      [andy: resolve merge conflict in asus-wmi.h]
      Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      8023eff1
  17. 24 9月, 2016 1 次提交
  18. 02 7月, 2016 1 次提交
    • J
      asus-wmi: Create quirk for airplane_mode LED · a977e59c
      João Paulo Rechi Vita 提交于
      Some Asus laptops that have an airplane-mode indicator LED, also have
      the WMI WLAN user bit set, and the following bits in their DSDT:
      
      Scope (_SB)
      {
        (...)
        Device (ATKD)
        {
          (...)
          Method (WMNB, 3, Serialized)
          {
            (...)
            If (LEqual (IIA0, 0x00010002))
            {
              OWGD (IIA1)
              Return (One)
            }
          }
        }
      }
      
      So when asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store the
      wlan state, it drives the airplane-mode indicator LED (through the call
      to OWGD) in an inverted fashion: the LED is ON when airplane mode is OFF
      (since wlan is ON), and vice-versa.
      
      This commit creates a quirk to not register a RFKill switch at all for
      these laptops, to allow the asus-wireless driver to drive the airplane
      mode LED correctly through the ASHS ACPI device. It also adds a match to
      that quirk for the Asus X555UB, which is affected by this problem.
      Signed-off-by: NJoão Paulo Rechi Vita <jprvita@endlessm.com>
      Reviewed-by: NCorentin Chary <corentin.chary@gmail.com>
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      a977e59c
  19. 28 5月, 2016 1 次提交
  20. 20 1月, 2016 1 次提交
  21. 11 11月, 2015 1 次提交
    • D
      asus-wmi: fix error handling in store_sys_wmi() · b8298340
      Dan Carpenter 提交于
      The asus_wmi_get_devstate_simple() returns 0-1 on success.  In theory
      according to static checkers, it can return either -EIO or -ENODEV on
      failure.  Currently the error handling code only handles -ENODEV and
      -EIO is treated as success.  Let's make it handle the -EIO error as
      well.
      
      It's possible that it can't actually return -EIO and this patch is not
      needed but in that case this patch is harmless and silences a static
      checker warning so it's still worth it.
      Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      b8298340
  22. 10 10月, 2015 1 次提交
  23. 03 10月, 2015 1 次提交
  24. 19 6月, 2015 2 次提交
    • H
      asus-wmi: Port to new backlight interface selection API · 62c4aa1a
      Hans de Goede 提交于
      Port the backlight selection logic to the new backlight interface
      selection API.
      
      This commit also removes various obsolete pr_xxx messages related to
      backlight interface selection. These are obsolete because they assume
      there is only a vendor or acpi backlight driver and no other choice.
      Also they are not necessary, if the user wants to know which backlight
      interfaces are registered a simple "ls /sys/class/backlight" suffices.
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Acked-by: NDarren Hart <dvhart@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      62c4aa1a
    • H
      asus-wmi: Use acpi_video_unregister_backlight instead of acpi_video_unregister · 4c27febf
      Hans de Goede 提交于
      acpi_video_unregister() not only unregisters the acpi-video backlight
      interface but also unregisters the acpi video bus event listener, causing
      e.g. brightness hotkey presses to no longer generate keypress events.
      
      The unregistering of the acpi video bus event listener usually is
      undesirable, which by itself is a good reason to switch to
      acpi_video_unregister_backlight().
      
      Another problem with using acpi_video_unregister() rather then using
      acpi_video_unregister_backlight() is that on systems with an intel video
      opregion (most systems) and a wmi_backlight_power quirk, whether or not
      the acpi video bus event listener actually gets unregistered depends on
      module load ordering:
      
      Scenario a:
      1) acpi/video.ko gets loaded (*), does not do acpi_video_register as there
         is an intel opregion.
      2) intel.ko gets loaded, calls acpi_video_register() which registers both
         the listener and the acpi backlight interface
      3) asus-wmi.ko gets loaded, calls acpi_video_unregister() causing both
         the listener and the acpi backlight interface to unregister
      
      Scenario b:
      1) acpi/video.ko gets loaded (*), does not do acpi_video_register as there
         is an intel opregion.
      2) asus-wmi.ko gets loaded, calls acpi_video_dmi_promote_vendor(),
         calls acpi_video_unregister(), which is a nop since acpi_video_register
         has not yet been called
      2) intel.ko gets loaded, calls acpi_video_register() which registers
         the listener, but does not register the acpi backlight interface due to
         the call to the preciding call to acpi_video_dmi_promote_vendor()
      
      *) acpi/video.ko always loads first as both other modules depend on it.
      
      So we end up with or without an acpi video bus event listener depending
      on module load ordering, not good.
      
      Switching to using acpi_video_unregister_backlight() means that independ
      of ordering we will always have an acpi video bus event listener fixing
      this.
      
      Note that this commit means that systems without an intel video opregion,
      and systems which were hitting scenario a wrt module load ordering, are
      now getting an acpi video bus event listener while before they were not!
      
      On some systems this may cause the brightness hotkeys to start generating
      keypresses while before they were not (good), while on other systems this
      may cause the brightness hotkeys to generate multiple keypress events for
      a single press (not so good). Since on most systems the acpi video bus is
      the canonical source for brightness events I believe that the latter case
      will needs to be handled on a case by case basis by filtering out the
      duplicate keypresses at the other source for them.
      
      Cc: Corentin Chary <corentin.chary@gmail.com>
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Acked-by: NDarren Hart <dvhart@linux.intel.com>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      4c27febf
  25. 08 6月, 2015 1 次提交
    • H
      asus-wmi: Use acpi_video_unregister_backlight instead of acpi_video_unregister · 5f770658
      Hans de Goede 提交于
      acpi_video_unregister() not only unregisters the acpi-video backlight
      interface but also unregisters the acpi video bus event listener, causing
      e.g. brightness hotkey presses to no longer generate keypress events.
      
      The unregistering of the acpi video bus event listener usually is
      undesirable, which by itself is a good reason to switch to
      acpi_video_unregister_backlight().
      
      Another problem with using acpi_video_unregister() rather then using
      acpi_video_unregister_backlight() is that on systems with an intel video
      opregion (most systems) and a wmi_backlight_power quirk, whether or not
      the acpi video bus event listener actually gets unregistered depends on
      module load ordering:
      
      Scenario a:
      1) acpi/video.ko gets loaded (*), does not do acpi_video_register as there
         is an intel opregion.
      2) intel.ko gets loaded, calls acpi_video_register() which registers both
         the listener and the acpi backlight interface
      3) asus-wmi.ko gets loaded, calls acpi_video_unregister() causing both
         the listener and the acpi backlight interface to unregister
      
      Scenario b:
      1) acpi/video.ko gets loaded (*), does not do acpi_video_register as there
         is an intel opregion.
      2) asus-wmi.ko gets loaded, calls acpi_video_dmi_promote_vendor(),
         calls acpi_video_unregister(), which is a nop since acpi_video_register
         has not yet been called
      2) intel.ko gets loaded, calls acpi_video_register() which registers
         the listener, but does not register the acpi backlight interface due to
         the call to the preciding call to acpi_video_dmi_promote_vendor()
      
      *) acpi/video.ko always loads first as both other modules depend on it.
      
      So we end up with or without an acpi video bus event listener depending
      on module load ordering, not good.
      
      Switching to using acpi_video_unregister_backlight() means that independ
      of ordering we will always have an acpi video bus event listener fixing
      this.
      
      Note that this commit means that systems without an intel video opregion,
      and systems which were hitting scenario a wrt module load ordering, are
      now getting an acpi video bus event listener while before they were not!
      
      On some systems this may cause the brightness hotkeys to start generating
      keypresses while before they were not (good), while on other systems this
      may cause the brightness hotkeys to generate multiple keypress events for
      a single press (not so good). Since on most systems the acpi video bus is
      the canonical source for brightness events I believe that the latter case
      will needs to be handled on a case by case basis by filtering out the
      duplicate keypresses at the other source for them.
      
      Cc: acpi4asus-user@lists.sourceforge.net
      Signed-off-by: NHans de Goede <hdegoede@redhat.com>
      Acked-by: Corentin Chary <corentin.chary@gmail.com)
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      5f770658
  26. 14 5月, 2015 1 次提交
    • K
      asus-wmi: add fan control · 53e755c2
      Kast Bernd 提交于
      This patch is partially based on Felipe Contrera's earlier patch, that
      was discussed here: https://lkml.org/lkml/2013/10/8/800
      Some problems of that patch are solved, now:
      
      1) The main obstacle for the earlier patch seemed to be the use of
      virt_to_phys, which is accepted, now
      
      2) random memory corruption occurred on my notebook, thus DMA-able memory
      is allocated now, which solves this problem
      
      3) hwmon interface is used instead of the thermal interface, as a
      hwmon device is already set up by this driver and seemed more
      appropriate than the thermal interface
      
      4) Calling the ACPI-functions was modularized thus it's possible to call
      some multifunctions easily, now (by using
      asus_wmi_evaluate_method_agfn).
      
      Unfortunately the WMI doesn't support controlling both fans on
      a dual-fan notebook because of an restriction in the acpi-method
      "SFNS", that is callable through the wmi. If "SFNV" would be called
      directly even dual fan configurations could be controlled, but not by using
      wmi.
      
      Speed readings only work on auto-mode, thus "-1" will be reported in
      manual mode.
      Additionally the speed readings are reported as hundreds of RPM thus
      they are not too precise.
      
      This patch is tested only on one notebook (N551JK) but a similar module,
      that contained some code to try to control the second fan also, was
      reported to work on an UX32VD, at least for the first fan.
      
      As Felipe already mentioned the low-level functions are described here:
      http://forum.notebookreview.com/threads/fan-control-on-asus-prime-ux31-ux31a-ux32a-ux32vd.705656/Signed-off-by: NKast Bernd <kastbernd@gmx.de>
      Acked-by: NCorentin Chary <corentin.chary@gmail.com>
      Cc: Corentin Chary <corentin.chary@gmail.com>
      Cc: Darren Hart <dvhart@infradead.org>
      Cc: Matthew Garrett <mjg59@srcf.ucam.org>
      Cc: Rafael J. Wysocki <rjw@rjwysocki.net>
      Signed-off-by: NDarren Hart <dvhart@linux.intel.com>
      53e755c2
  27. 04 12月, 2014 1 次提交
  28. 16 8月, 2014 3 次提交
  29. 11 6月, 2014 1 次提交
  30. 30 5月, 2014 1 次提交
  31. 21 1月, 2014 1 次提交